
rule IC
{

	meta:
		description = ""
	condition:
            math.ic(0,filesize) < 0.039 and   math.ic(0,filesize) > 0.037

}


rule CompressRatio
{

	meta:
		description = ""
	condition:
            filesize >100KB and math.compression(0,filesize) <0.3186

}


rule Encrypt_Webshell {
	meta:
	    author = "host"
	condition:
	    math.encrypt(0,filesize,500) > 0  
}

rule  SpecialChar{
	meta:
		description = "AspShellFile"
		author = "hos@ysrc"
		date = "2016-12-31"
	condition:
         math.ratio(0,filesize,"") > 0.10 or  math.ratio(0,filesize,"*")>0.10 
}


rule Entropy
{

	meta:
		description = "mbl asp backdoor"
		author = "hos@ysrc"
		date = "2016-12-26"
		md5 = "2806348182e338f48df854c677296b77"
	
	condition:
            math.entropy(0,filesize) > 6

}






